Static task
static1
General
-
Target
ace373f69d10a9c7f6c547065594702b
-
Size
48KB
-
MD5
ace373f69d10a9c7f6c547065594702b
-
SHA1
0aac5278c77f3799a64de23fac97fd914f2315f1
-
SHA256
4657c4baff7ac8d86d96bdce5a3cfc8ad7a329a4e5a534ff5c1fb4533ccde45f
-
SHA512
436688a97e080b7394e42396533108a1d09c0d7181c43f0a8a055ec9dff171d08fac94fcc620a146fbd5ca7abc20768311d0f2782ee1a628f19307d46b7f5379
-
SSDEEP
768:PqL95SdADXsUcTEG4MBmc6jTmOoa6bER9LwqqdUrqdy/0HGv4S:if8AD8FTEDMb6jTJoa6IPwBdhE0HGA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ace373f69d10a9c7f6c547065594702b
Files
-
ace373f69d10a9c7f6c547065594702b.sys windows:4 windows x86 arch:x86
0f8202e878dd70f10cbc585998e1ff7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
ZwClose
ZwUnmapViewOfSection
RtlInitUnicodeString
PsTerminateSystemThread
wcscat
wcscpy
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
ZwCreateKey
swprintf
RtlAnsiStringToUnicodeString
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsGetVersion
_wcslwr
wcsncpy
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 224B - Virtual size: 207B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 832B - Virtual size: 804B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 928B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 736B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ